🔴 CRITICAL 10.0 · Confection WordPress Cable: unauthenticated remote code execution in settings saving (CVE-2026-115252)
Anyone on the network can run arbitrary PHP code on the server without logging in.
👉 No patch yet · affected: >=0.4.0 <=0.4.7
https://t.co/DQ3XGMFJ11
Think you're testing for Broken Access Control properly? The OWASP Top 10 #1 is where the bounties hide. 🐀 In this 1-hour deep dive I walk through how to test for BAC the right way. https://t.co/DDClMmDK8S Ready for the next step? The Big Beautiful Bug Bounty Bundle (discount applies via the link): https://t.co/tHmVgNttnE #infosec #bugbounty
Most JWT bugs die on the first three checks. Here's the exact order I run my five-check chain to break token auth before touching business logic: https://t.co/2gGJxTeucb #infosec#bugbounty#JWT Next step if you liked this: the Big Beautiful Bug Bounty Bundle (discount applies via the link): https://t.co/tHmVgNttnE
Alcuni ricercatori di sicurezza informatica hanno scoperto online centinaia di installazioni attive ed esposte di un software basato sull'intelligenza artificiale, di origine cinese, sviluppato per condurre attacchi informatici. #ANSA https://t.co/1KAkl3VBjr
‼️ #Exploited#WordPress: rilevato sfruttamento attivo in rete della CVE-2026-119977
Rischio: 🔴
Tipologia:
🔸 Remote Code Execution
🔗 https://t.co/T9hIAvb4xg
⚠️ Importante mantenere aggiornati i sistemi
🚨 OSINT INVESTIGATION: https://t.co/wzdbsmE9Lu
Domain “fr4ud” (leetspeak for fraud) registered on June 16, 2026 via GoDaddy + Cloudflare.
It presents “BRZ Control Criminal” — an Android + Desktop suite with: • Remote control and screen capture • APK builder • Banking injects • APK bypass • Data lookups (including databases targeting the elderly)
100% PIX payments (no personal data required). No CNPJ, no corporate identity.
Tweet 2/3 Subdomain https://t.co/wHCYHpEUxM (“FR4UD Center”): operational query panel (CPF, phone, license plate, RG, credit score, documents such as CRLV) + API, with plans starting at R$ 29/month.
Linked to https://t.co/DiLPTFM9yY (“FR4UD SHOP”), an open storefront selling logins, fake APKs, panels, and fraud tools.
Typical disposable operation architecture: young domain, privacy protection, CDN, and low public footprint.
Tweet 3/3 Conclusion: commercial cluster of tools and data oriented toward fraud and unauthorized access within the Brazilian “painéis” + mobile malware ecosystem.
Avoid any interaction.
#CyberSecurity #OSINT #ThreatIntel #Fraud #Brazil #CyberCrime #Malware #InfoSec #ThreatHunting #DigitalFraud #Cybersecurity #OSINTBrazil
🚨 Esta web parece sacada de una agencia de ESPIONAJE.
Puedes seleccionar una región y generar un informe con información sobre ese lugar (lo más INQUIETANTE es que utiliza información pública).
Desde un único mapa puedes consultar:
- Información sobre ciberamenazas.
- Noticias y acontecimientos internacionales.
- Aviones y sus trayectorias.
- Barcos navegando por los océanos.
- Satélites alrededor de la Tierra.
- Cámaras públicas.
- Terremotos e incendios forestales.
Se llama GORGONA EYE y convierte todo el planeta en un centro de inteligencia global.
También incorpora herramientas para investigar direcciones IP, dominios y vulnerabilidades conocidas.
Y sin necesidad de acceder a información clasificada.
Bienvenidos a https://t.co/lssf2T0XeE donde verás todo desde una interfaz que parece el centro de operaciones de una película de espionaje.
‼️ #MariaDB: Proof of Concept (#PoC) per lo sfruttamento delle vulnerabilità CVE-2026-92262, CVE-2026-85748, CVE-2026-85746 e CVE-2026-107821
Rischio: 🔴
⚠ Aggiornare tempestivamente il software interessato
👉 link al post principale: https://t.co/1gLrGbVIZ6